Researchers at the University of Toronto's Citizen Lab have published what they describe as the first concrete technical evidence that government-linked spyware has been delivered to victims through ordinary online advertisements, without the target clicking anything at all.
The findings, reported by TechCrunch on 15 October, describe how an Israeli company presenting itself as a legitimate advertising firm allegedly enabled spyware makers to target specific people and devices through the global digital advertising system.
"Now for the first time, we have concrete technical evidence showing this process in action," said Bill Marczak, a senior researcher at Citizen Lab.
How the Attack Worked
The investigation centres on Discover-Tech, an Israeli company that, according to Citizen Lab, acts as a "bridge between ad vendors and the mercenary spyware ecosystem". Its platform, called Controlium, allowed customers to use the targeting capabilities of online advertising to deliver malicious ads to chosen individuals or devices.
Because modern advertising systems can target users based on location, device characteristics and other data, they can be repurposed to reach specific people. In the cases documented by Citizen Lab, simply displaying a malicious ad on a target's device was enough to deliver spyware, a so-called zero-click attack that requires no action from the victim.
Two spyware makers were linked to the platform: Candiru, an Israeli company that the US Commerce Department added to its trade blacklist in 2021, and Bindecy, another developer of zero-click spyware. Login records for employees of both companies were exposed during the investigation.
Al Jazeera Among the Victims
Citizen Lab found that at least 45 Windows computers at broadcaster Al Jazeera were apparently hacked in 2024 and 2025 using Candiru spyware after being shown malicious ads.
The researchers also found that ads delivered through Discover-Tech's system appeared on devices used by militaries, governments, critical infrastructure operators and national cybersecurity agencies, although it is not clear whether any of those devices were compromised. Ad security company Confiant, which worked with Citizen Lab on the investigation, found potentially malicious ads on networks belonging to the International Atomic Energy Agency and the International Criminal Court.
Citizen Lab did not identify which governments were behind the attacks.
Billions of Bids, Tens of Thousands of Apps
The scale of the infrastructure was considerable. Exposed bidding records, numbering in the billions, showed that Discover-Tech's ads ran across tens of thousands of mobile apps and websites between March and June 2026.
Discover-Tech's dashboard source code was also exposed, allowing the researchers to reconstruct its control panel without logging in. Marczak said the company was "surely just the tip of the iceberg", suggesting other firms may offer similar capabilities.
Discover-Tech did not respond to requests for comment. Al Jazeera did not respond, and Integrity Labs, the maker of Candiru's spyware, could not be reached.
A Problem for the Advertising Industry
The findings pose uncomfortable questions for the digital advertising industry, which handles hundreds of billions of dollars in spending each year through automated auctions that place ads in fractions of a second.
Programmatic advertising involves complex chains of intermediaries, including ad exchanges, supply-side and demand-side platforms, and data providers. That complexity has long made the system vulnerable to fraud and malicious ads, known as malvertising. Citizen Lab's research suggests the same infrastructure can be weaponised for targeted surveillance.
Advertisers, publishers and ad platforms may face pressure to improve vetting of intermediaries and to strengthen controls on how targeting data can be used. Regulators concerned with privacy and cybersecurity may also scrutinise how much personal data flows through ad systems and who can access it.
What It Means for Businesses
For companies, the research highlights that employees can be targeted through channels that traditional security tools may not monitor closely. Executives, journalists, lawyers and government contractors may be at particular risk.
Marczak's advice was blunt: "It's time to disable ad tracking on your devices or even block ads altogether."
Many organisations already use ad-blocking and DNS filtering on corporate networks, partly for security reasons. The Citizen Lab findings could encourage wider adoption, as well as stricter policies on which apps can run on corporate devices.
Relevance for India
India is one of the world's largest digital advertising markets by audience size, with hundreds of millions of smartphone users and a heavy reliance on free, ad-supported apps. The country's Digital Personal Data Protection Act, which governs how companies collect and process personal data, is being implemented in phases, and debates over how targeting data is used and shared are likely to intensify.
India has also been at the centre of controversy over commercial spyware in the past, adding to the relevance of the findings for Indian policymakers, journalists and businesses.
The Mercenary Spyware Market
The research adds to a growing body of evidence about the scale of the commercial spyware industry. Companies in this market sell sophisticated hacking tools, often marketed as being for law enforcement and intelligence agencies to fight crime and terrorism. Investigations by Citizen Lab, Amnesty International and others have repeatedly found such tools used against journalists, human rights defenders, opposition politicians and business executives.
Zero-click attacks are especially concerning because they leave targets with no opportunity to avoid infection by being cautious. Earlier zero-click techniques typically exploited vulnerabilities in messaging apps or operating systems. The use of advertising networks as a delivery channel suggests that spyware vendors are diversifying their methods, potentially reaching targets on devices and platforms that have been hardened against other forms of attack.
The Bigger Picture
The commercial spyware industry has faced growing international scrutiny, with the US government sanctioning several vendors and dozens of countries signing commitments to curb misuse. Citizen Lab's research shows that the industry continues to find new ways to reach targets, and that the infrastructure of the digital economy itself can become a delivery mechanism.
For the technology industry, the episode is a reminder that systems built to target consumers with relevant ads can, in the wrong hands, be used to target individuals with surveillance. Closing that gap will require action from ad platforms, device makers, regulators and security researchers alike.
